Why it matters
Published vulnerabilities come with write-ups that explain how they work, which makes them cheap to exploit. Not every advisory can be reached on every site, but updating is usually quicker than working out whether yours can. Because the databases change daily, a site that was fine last month can have a problem today without anything changing on your side.
How Patch checks
We identify components from version globals, licence banners, file names, CDN URLs, generator tags and headers, then match each version against advisories from OSV.dev (which includes the GitHub Advisory Database), using each advisory's exact version ranges. We show the CVSS severity, the EPSS chance of exploitation where there is one, the version that fixes it, and how confident we are in the version we read.
How to fix it
- Update the component to the fixed in or later.
- If it comes from npm, run npm install the npm name@the fixed in and redeploy. If it's a CDN link or a copied file, change the version in the URL or replace the file.
- Retest the parts of the site that use it. The advisories.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.